CVE-2026-82211

Executive Summary

CVE-2026-82211 is a missing authorization vulnerability (CWE-862) in the Nexi XPay Build WordPress plugin through version 7.6.2. The plugin fails to verify the payment result supplied to several of its unauthenticated routes, enabling any remote attacker to mark arbitrary orders as paid or failed, cancel orders, and obtain order keys that expose guest buyers' details. With a CVSS score of 8.2, unauthenticated exploitation can lead to high integrity impact on e-commerce operations and low confidentiality impact via order data disclosure.

Technical Analysis

The vulnerability resides in the Nexi XPay Build plugin's handling of unauthenticated request routes that process payment results. According to the NVD description, the plugin "does not verify the payment result supplied to several of its unauthenticated routes." This indicates a missing authorization check (CWE-862): requests to these routes are accepted and acted upon without validating that the payment result originates from an authorized party (e.g., the payment gateway) or that the requester is authenticated.

The attack surface comprises publicly accessible WordPress AJAX or REST endpoints registered by the plugin (the specific route names are not disclosed in the available intelligence). Because these routes are unauthenticated, no session, nonce, or capability check is enforced. An attacker can supply a crafted "payment result" parameter to influence order state transitions.

The consequences described are:

• Marking arbitrary orders as paid or failed.
• Cancelling arbitrary orders.
• Obtaining order keys that expose guest buyers' details.

These actions map directly to broken access control over order management functionality. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms remote, low-complexity exploitation with no privileges or user interaction. The scope is unchanged (S:U), with low confidentiality impact (C:L) and high integrity impact (I:H), while availability is not impacted (A:N).

Insufficient technical detail is available regarding the exact parameter names, route paths, or server-side function implementations. The analysis therefore remains at the vulnerability-class level: a lack of verification on unauthenticated payment-result routes permits unauthorized order state manipulation and data exposure.

Exploitation Scenarios

No public PoC or exploit code is available; the attack chain is inferred from the vulnerability class and the NVD description.

1. Reconnaissance/target identification: The attacker identifies WordPress sites running the Nexi XPay Build plugin version 7.6.2 or earlier. This can be done by scanning for known plugin assets or fingerprinting the plugin's presence via public resources (e.g., Shodan dorks for plugin paths). No authentication is required to reach the vulnerable routes.

2. Triggering the flaw: The attacker sends crafted requests to one or more of the plugin's unauthenticated routes that handle payment results. Because the plugin does not verify the supplied payment result, the attacker can submit arbitrary values indicating a payment outcome (e.g., success, failure, or cancellation).

3. Execution method: At the vulnerability-class level, the attacker manipulates the "payment result" parameter passed to the unauthenticated route. By choosing an order identifier and a forged payment status, the attacker causes the plugin to update the order state accordingly. No specific parameter names or route paths are provided in the available intelligence.

4. Post-exploitation impact:

   • Integrity: Arbitrary orders can be fraudulently marked as paid (enabling goods or services to be obtained without payment) or failed (disrupting legitimate purchases). Orders can also be cancelled at will, causing business disruption.
   • Confidentiality: By obtaining order keys, the attacker can access guest buyers' details. Order keys typically serve as access tokens for order status pages, and their disclosure can leak personally identifiable information of guest purchasers.
   • The attack can be repeated across many orders, amplifying business and privacy impact.

No public exploit code exists; the described steps are a logical reconstruction from the vulnerability description.

Impact Assessment

The vulnerability affects any WordPress site using the Nexi XPay Build plugin through version 7.6.2. With CVSS 8.2 and a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N, the flaw is remotely exploitable without authentication or user interaction. The integrity impact is high (I:H) because order states can be arbitrarily altered, leading to financial fraud (false payment confirmations) and operational disruption (unauthorized cancellations). The confidentiality impact is low (C:L) because order keys can expose guest buyers' details, though the scope is limited to order-related data. Availability is not impacted (A:N). The blast radius includes all orders processed through the vulnerable plugin, including guest purchases, and potentially any customer data accessible via order keys. In a business context, this translates to direct financial loss, reputational damage, and potential privacy regulation violations (e.g., GDPR) due to exposure of guest buyer details.

Detection Guidance

Sigma Rule

title: Suspicious Unauthenticated Payment Result Manipulation in Nexi XPay Build Plugin
id: 8f3a2b1c-4d5e-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects requests to unauthenticated routes of the Nexi XPay Build WordPress plugin that may indicate payment result manipulation (CVE-2026-82211).
author: Valters IT
date: 2026-01-01
logsource:
  category: webserver
  product: apache
  service: access_combined
detection:
  selection_uri:
    cs-uri-stem|contains:
      - '/wp-admin/admin-ajax.php'
      - '/wp-json/'
  selection_params:
    cs-uri-query|contains:
      - 'nexi'
      - 'xpay'
      - 'payment_result'
      - 'order_key'
      - 'esito'
  condition: selection_uri and selection_params
fields:
  - client_ip
  - cs-uri-stem
  - cs-uri-query
  - sc-status
falsepositives:
  - Legitimate payment gateway callbacks from Nexi servers
level: high
tags:
  - attack.t1190
  - cve.2026.82211

YARA Rule

rule CVE_2026_82211_Nexi_XPay_Build_Unauth_Payment_Result
{
    meta:
        description = "Detects Nexi XPay Build plugin files or requests referencing unauthenticated payment result routes (CVE-2026-82211)"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-82211"
        severity = "high"
    strings:
        $plugin = "nexi-xpay-build" ascii wide nocase
        $route1 = "payment_result" ascii wide nocase
        $route2 = "order_key" ascii wide nocase
        $route3 = "esito" ascii wide nocase
        $route4 = "xpay" ascii wide nocase
    condition:
        $plugin and any of ($route*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-82211 Nexi XPay Build Unauthenticated Payment Result Manipulation Attempt"; flow:to_server,established; http.uri; content:"/wp-admin/admin-ajax.php"; http.uri; content:"action="; http.uri; content:"nexi"; nocase; http.uri; content:"payment_result"; nocase; classtype:attempted-admin; sid:10000001; rev:1; reference:cve,2026-82211; metadata:mitre_tactic_technique T1190;)

Elastic Detection

sequence by host.hostname with maxspan=5m
  [ network where network.protocol == "http" and url.path == "/wp-admin/admin-ajax.php" and url.query : ("*nexi*" or "*xpay*") ]
  [ network where network.protocol == "http" and url.query : ("*payment_result*" or "*order_key*" or "*esito*") ]

Splunk SPL Query

index=web sourcetype=access_combined
| search (uri="/wp-admin/admin-ajax.php" OR uri="/wp-json/*") (uri_query="*nexi*" OR uri_query="*xpay*" OR uri_query="*payment_result*" OR uri_query="*order_key*")
| stats count values(uri) as uris values(uri_query) as queries by clientip, status
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,wordpress,">
  <rule id="100001" level="12">
    <if_sid>31100</if_sid>
    <match>wp-admin/admin-ajax.php</match>
    <regex>nexi|xpay|payment_result|order_key</regex>
    <description>CVE-2026-82211: Possible Nexi XPay Build unauthenticated payment result manipulation attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_82211,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Disable the Nexi XPay Build plugin until an official patch is available. This removes the vulnerable unauthenticated routes.
   • If the plugin must remain active, implement strict request filtering at the web application firewall (WAF) to block unauthenticated requests to the plugin's payment result routes that do not originate from trusted payment gateway IPs. Since the exact route paths are not publicly disclosed, a deny-by-default approach for unauthenticated plugin routes is advised.
   • Monitor order state changes for anomalies (e.g., orders marked paid without corresponding gateway transactions) and alert on guest order key access from unexpected IPs.

2. Patch/upgrade steps:

   • No vendor patch is currently available. Monitor the Nexi XPay Build plugin's official repository and WordPress plugin directory for a security update. Once released, upgrade to the patched version immediately.
   • Until a patch exists, consider replacing the plugin with an alternative payment integration that properly authenticates payment result callbacks.

3. Long-term hardening:

   • Enforce authentication and nonce verification on all plugin routes that modify order state.
   • Validate the authenticity of payment callbacks (e.g., signature verification with the payment provider).
   • Conduct regular security reviews of third-party plugins, especially those handling payments.
   • Implement least-privilege principles for guest order key access and avoid exposing order details through guessable or leakable keys.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-82211
• Nexi XPay Build WordPress plugin directory: https://wordpress.org/plugins/nexi-xpay-build/
• CWE-862: Missing Authorization: https://cwe.mitre.org/data/definitions/862.html
• MITRE ATT&CK T1190: Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• No known threat actor campaigns or exploit-in-the-wild evidence has been observed as of this report.